A description of a state of benevolence that exists between two or more parties. A measurement of the confidence in a benign outcome of a transaction involving two or more parties.

learn more… | top users | synonyms

65
votes
12answers
8k views

How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?

This question has been revised & clarified significantly since the original version. If we look at each trusted certificate in my Trusted Root store, how much should I trust them? What factors ...
93
votes
6answers
17k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
13
votes
1answer
5k views

What is the exact meaning of this gpg output regarding trust?

When I import signatures or receive a key with gpg, it outputs some cryptic lines like: gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 16 trust: ...
107
votes
14answers
29k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
17
votes
3answers
2k views

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, ...
11
votes
1answer
2k views

How does an end user differentiate between OV and DV certificates?

This is a very good link that explains the different types of SSL certificates and level of trust provided by them. An Extended Validation (EV) certificate it is easily identified by the green color ...
11
votes
3answers
6k views

Is it possible to get all the data I send through wifi?

Is it possible, that the network administrator (wpa2 wifi network) can log all the data the users send and then get password out of it? I know it is not possible to get the password if I'm surfing ...
26
votes
2answers
7k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
9
votes
2answers
412 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
13
votes
3answers
3k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate ...
9
votes
4answers
202 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
9
votes
8answers
1k views

How do I choose whether to trust a particular website?

From @GrahamLee's comment over on this question, this is a very good point: How do I choose whether to trust a particular website when the only information I have relevant to my trust decision is the ...
5
votes
1answer
423 views

Trusted Timestamping Scope and Real-World Uses

What security assurances does Trusted Timestamping based on Cryotography provide? What are the real-world uses of Trusted Timestamping?
2
votes
3answers
4k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
3answers
307 views

Should I trust my bank after this [closed]

I have just discovered that I can login to my bank with passwords that is not mine. Example: My password is "1234" but I am authorized with all possible post characters. For example "12345" or "...
94
votes
8answers
27k views

Why would someone trust DuckDuckGo or other providers with a similar privacy policy?

DuckDuckGo is a search engine that claims it will not share your results with others. Many of my skeptical coworkers think it may be a scam. Is there any proof that any web search engine will ...
10
votes
4answers
9k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
8
votes
4answers
1k views

Alternative to “web of trust”

Let's say I have an SMIME platform where I want to easily establish trust across the entire world for a particular purpose, for example for sharing valid financial information. I think that a ...
14
votes
4answers
3k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
8
votes
1answer
743 views

How safe is “trust this computer” option for websites?

Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the ...
4
votes
2answers
127 views

Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised?

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company ...
7
votes
4answers
307 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
5
votes
1answer
578 views

'Trusted CA Certificates' and 'Trusted remote Certificates'

What is the difference between Trusted CA Certificates and Trusted remote Certificates?
2
votes
1answer
233 views

Is it possible to design a system where the client doesn't have to trust the server?

When you are using services like chat, file sending, exchanging etc., you always have to trust server providing these services. The only way to use services without having to trust third party is to ...
8
votes
2answers
2k views

TPM and storage of keys

A TPM hardware device has very limited non-volatile protected memory just sufficient to store the EK (Endorsement Key) and SRK (Storage Root Key). How does a TPM allow nearly unlimited number of ...